Home / Knowledge hub / Output encoding
Knowledge hub
Output encoding
Escaping data for its destination so it is shown as text, not run as code.
What it means
Output encoding converts data into a safe form for the place it is about to be used, so that it is displayed as plain text and never run as code. In HTML, the character < is written as < so the browser shows it rather than treating it as a tag.
The key idea is that encoding depends on the destination. HTML body text, an HTML attribute, JavaScript, a URL and a CSS value each have different dangerous characters and different escape rules. One encoding does not fit them all, and choosing the wrong one can leave a gap that looks closed.
Why it matters
It is the main defence against cross-site scripting. If a customer's comment can contain a script and your page prints it unencoded, every visitor who views it runs that script in your site's name, with their own session. That is how accounts are taken over and pages are quietly rewritten.
OWASP's guidance is that encoding at output is the primary control, with input checks as support. It also copes better with the real world, where the same data is used in several places, and you cannot know when it is stored which one it will reach.
How it shows up
Modern templating frameworks encode by default for HTML, which is why most XSS now arrives through the exceptions: raw-output helpers, direct writes to innerHTML, building attributes by hand, inserting data into script blocks or URLs, and rendering rich text or markdown.
Use the framework's automatic encoding and treat every escape hatch as a review point. Encode as late as possible, for the right context, and use trusted libraries rather than your own functions. A content security policy is a useful second layer, not a replacement.
Questions people ask
Output encoding, answered
What is the difference between input validation and output encoding?
Input validation checks data on arrival and rejects what does not fit. Output encoding makes data safe on the way out for where it will be used.
Do both, but encoding is the stronger defence against cross-site scripting.
Is output encoding the same as escaping?
Close. Escaping usually means adding a backslash or entity to special characters, and encoding is the wider term for converting data to a safe representation for a context.
In everyday talk they mean the same thing.
Why does context matter?
Because what is dangerous in one place is harmless in another. A quote mark can break out of an HTML attribute but not out of body text.
Using the wrong encoding for the place leaves a gap while looking safe.
Do frameworks handle it for us?
Mostly for HTML text. Many frameworks encode by default, but offer ways to switch it off, and they do not protect JavaScript contexts, URLs or raw HTML insertion.
Search the code for those exceptions.
Should we encode when saving or when displaying?
When displaying. Store the original data, then encode for each place it is shown. Encoding on save locks you into one context and can corrupt the data.
Late encoding fits the real destination.
Sources
Where this comes from
Related
Terms that sit next to this one
XSS
An attacker's script running in your pages, in your customers' sessions.
Stored XSS
Malicious script saved by your app and then served to other people who view it.
Input sanitisation
Cleaning or stripping risky characters from input, which is weaker than encoding.
Content Security Policy
A header telling the browser which scripts a page may load.
Trusted Types
A browser feature that blocks unsafe strings from being written into the page.
Where does your data end up?
We test where user-supplied data is shown back in pages and report only what we proved, with the request, the response and a screenshot where a person can see it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.